System and method for minimizing inter-application interference among static synchronized methods

ABSTRACT

A system and method for isolating the execution of a plurality of applications. A plurality of monitors are provided for a plurality of applications to access a static synchronized method. The applications are enabled to call the static synchronized method concurrently by accessing the static synchronized method through the plurality of monitors. A plurality of threads within one of the applications are excluded from calling the static synchronized method concurrently. The source code or bytecode for the synchronized method may be transformed by removing a method-level monitor and adding the plurality of monitors inside the method. In one embodiment, each static synchronized method is replaced with a corresponding static non-synchronized method. The applications may be further isolated by placing the static fields of shared classes into a static field class, which has one instance per utilizing application. The static non-synchronized method includes the body of the corresponding static synchronized method, wherein the body is synchronized on the instance of the static field class that corresponds to the utilizing application.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to computer software. Moreparticularly, the present invention relates to the efficient isolationof applications executing concurrently in a multi-processingenvironment.

2. Description of the Relevant Art

The growing popularity of the platform-independent programming languageJava™ has brought about an increased need for executing multiple Java™applications co-located on the same computer. Ideally, such applicationsshould be protected from one another. In other words, an applicationshould not be able to corrupt the data of another, and the applicationshould not be able to prevent another application from performing itsactivities. At the same time, marginal systems resources needed to startnew Java™ applications should be as small as possible so that the numberof concurrently executing applications can be as high as possible.

One approach to Java™ multiprocessing is to rely on the operating system(OS) for protection. Typically, this means running multiple copies ofthe Java™-Virtual Machine (JVM), one per application, starting eachapplication in a separate copy of the JVM, which effectively is spawninga new operating system process for each application. This provides astrong process-level separation in that applications are totallyisolated from one another (although they can communicate, for instance,via sockets, RMI, etc), but uses large amounts of resources in terms ofvirtual memory and startup time, and makes inter-applicationcommunication expensive. In addition, this approach tends to scalepoorly.

A project at the University of Utah resulted in two variants of Java™operating systems which demonstrate how a process model can beimplemented in Java™ and how an underlying OS protection can beexploited for Java™ multiprocessing. See Back, G., Tullmann, P.,Stoller, L., Hsieh, W., and Lepreau, J., Java Operating Systems: Designand Implementation, Technical Report UUCS-98-015, Department of ComputerScience, University of Utah, August 1998. The first system, GVM, isstructured much like a monolithic kernel and focuses on completeresource isolation between processes and on comprehensive control overresources. A GVM process comprises a class loader-based name space, aheap, and a set of threads in that heap. In addition to their own heaps,all processes have access to a special, shared system heap. For everyheap, GVM tracks all references leading to other heaps and allreferences pointing into it. This information is used to implement aform of distributed garbage collection. The CPU management in GVMcombines CPU inheritance scheduling with the hierarchy introduced byJava™ thread groups: thread groups within processes may hierarchicallyschedule the threads belonging to them.

A second variant of a Java™ operating system developed at the Universityof Utah, Alta, closely models a micro-kernel model with nestedprocesses, in which a parent process can manage all resources availableto child processes. Memory management is supported explicitly, through asimple allocator-pays scheme. The garbage collector credits the owningprocess when an object is eventually reclaimed. Because Alta allowscross-process references, any existing objects are logically added intothe parent memory. This makes the parent process responsible for makingsure that cross-process references are not created if full memoryreclamation is necessary upon process termination. Both GVM and Alta areimplemented as considerable modifications to the JVM. Both systemssupport strong process models: each can limit the resource consumptionof processes, but still permit processes to share data directly whennecessary.

Advocates of process-based Java™ application separation point out that afailure of one process terminates only this particular application andmay potentially affect other applications only through an absence ofservice. Common wisdom states that processes are more reliable thanimplementations of JVMs. This reasoning implies that executing multipleapplications in a single copy of the JVM puts them at a risk of beingabruptly terminated because another application triggers an action,which will cause the whole JVM to go down. However, it does notnecessarily have to be so. Processes still execute on top of anunderlying operating system, and no major operating system kernel isguaranteed to be bug-free. Ultimately, one trusts software, whether itis an OS or a runtime of a safe language. The reliability issues of theJava™ platform and of an OS kernel are essentially the same. Moreover,safe language has less potential for crashing because of softwareproblems.

The SPIN extensible operating system, written almost entirely in a safesubset of Modula-3, utilizes both hardware and software protection. SeeBershad, B., Savage, S., Pardyak, P., Sirer, E., Fiuczynski, M., Becker,D., Eggers, S., and Chambers, C., Extensibility, Safety and Performancein the SPIN Operating System, 15^(th) ACM Symposium on Operating SystemsPrinciples, Copper Mountain, Colo., December 1995. Hardware protectionis used to isolate address spaces; software protection protects the OSkernel from extensions. However, it is the view of the SPIN authors thatprotection is a software issue, and that with a well-designedinter-application isolation in a safe language, there should be no needfor hardware protection. See Bershad, B., Savage, S., Pardyak, P.,Becker, D., Fiuczynski, M., Sirer, E., Protection is a Software Issue,5^(th) Workshop on Hot Topics in Operating Systems, Orcas Island, Wash.,May 1995.

An alternative approach is to execute applications in the same instanceof the JVM. Typically, each application is loaded by a separate classloader. See Liang S., and Bracha, G., Dynamic Class Loading in the JavaVirtual Machine, In Proceedings of ACM OOPSLA'98, Vancouver, BC, Canada,October 1998. This code replication is especially wasteful in thepresence of just-in-time compilers (JITs). Currently available classloading mechanisms separately compile and separately store the JITedcode of each loaded class, regardless of whether the class has alreadybeen loaded by another application or not. This can easily lead tosignificant memory footprints, since, on the average, a byte of bytecodemay translate into about five bytes of native code, where the termbytecode refers to compiled Java™ code. See Cramer, T., Friedman, R.,Miller, T., Seberger, D., Wilson, R., and Wolczko, M., Compiling JavaJust in Time, IEEE Micro, May/June 1997. Combined with the safety of thelanguage, this approach leads to systems where applications are mostlyisolated from one another. The place where the isolation breaks is theinteraction of applications through static fields and staticsynchronized methods of system classes (as they are not subject toper-application replication).

A simple example of a Java™ multiprocessing utilizing class loaders isthe class library Echidna. With a reasonable degree of transparency, itallows multiple applications to run inside a single JVM. Applicationscan cleanly dispose of important resources when they are killed. Forexample, when a process is killed all its windows are automaticallyremoved.

A more complex example of a class loader based approach to applicationprotection is the J-Kernel. See Hawblitzel, C., Chang, C-C., Czajkowski,G., Hu, D. and von Eicken, T., Implementing Multiple Protection Domainsin Java, In Proceedings of USENIX Annual Conference, New Orleans, La.,June 1998. The J-Kernel adds protection domains to Java and makes astrong distinction between objects that can be shared between tasks andobjects that are confined to a single task. Each domain has its ownclass loader. The system, written as a portable Java™ library, providesmechanisms for clean domain termination (e.g., no memory allocated bythe task is “left over” after it is terminated) and inter-applicationcommunication (performed via deep object copies or methods arguments andreturn values).

Balfanz and Gong designed a multiprocessing JVM in order to explore theuse of the Java™ security architecture to protect applications from eachother. See Balfanz, D., and Gong, L., Experience with SecureMulti-Processing in Java, Technical Report 560-97, Department ofComputer Science, Princeton University, September, 1997. The proposedextensions enhance the standard JVM so that it can supportmultiprocessing. An important part of the work is clear identificationof several areas of the JDK that assume a single-application model.

Two current trends cast doubt on the future usefulness of these twoapproaches to Java™ multiprocessing. On one end of the computing powerspectrum, high-end high-throughput servers have to deal with largevolumes of concurrently executing Java™ programs. Increasingly, inaddition to traditional, large and self-contained applications, smallerentities (e.g., applets, servlets, and JavaBeans™ components) are partof the computation system. The OS-based approach to Java™multiprocessing is often unacceptable in these settings since itrequires allocating large amounts of system resources for starting manycopies of the JVM and thus tends to scale very poorly. Using classloaders has the potential for better scaling performance but it alsowastes resources on replicating application code when more than oneapplication executes the same program. Indicated isolationinconsistencies make this approach unsafe in general.

On the other end of the spectrum, small-footprint JVMs are emergingwhich target small devices. They typically lack many features availablein fully blown implementations of the JVM available on general-purposecomputers. An example is the K Virtual Machine (KVM) from SunMicrosystems, Inc. Since the KVM specification does not require that itsimplementations provide class loaders, multiprocessing in a singleinstance of the KVM is possible only when all applications are trustedand guaranteed not to interfere with one another. Process-basedmultiprocessing using KVM is also problematic since small devices forwhich it is meant do not necessarily provide a process model withadequate strong application separation guarantees. Another example of aJava™-based system without an underlying OS process abstraction isJavaOS™.

As stated above, systems offering Java™ multiprocessing can beclassified as either based on an underlying operating system, whichtypically means running one process for each Java™ application, or asusing class loaders. However, using operating system processes isexpensive, scales poorly, and does not fully exploit the protectionfeatures inherent in a safe language. Class loaders replicateapplication code, obscure the type system, and non-uniformly treat“trusted” and “untrusted” classes, which leads to subtle butnevertheless potentially harmful forms of undesirable inter-applicationinteraction.

One way to achieve multi-tasking in a single processing space is throughthe use of threads. Multithreaded applications may be written inlanguages such as C and C++, but writing multithreaded C and C++applications may be difficult. Furthermore, there are no assurances thatthird-party libraries are thread-safe. As used herein, “thread-safe”means that a given library function is implemented in such a manner thatit can be safely executed by multiple concurrent threads of execution.Thread-safe programming often relies on “locks” or “monitors,” which areused synonymously herein. One major problem with explicitly programmedthread support is that acquiring and releasing the locks needed at theright time tends to be difficult. For example, if a method returnsprematurely, or if an exception is raised, and a related lock has notbeen released, deadlock usually results.

The Java™ Language provides some built-in support for threads. The Java™library provides a Thread class that supports a rich collection ofmethods to start a thread, run a thread, stop a thread, and check on athread's status. This built-in support for threads provides Java™programmers with a powerful tool to improve interactive performance ofgraphical applications. If an application desires to run animations andplay music while scrolling the page and downloading a text file from aserver, for example, then multithreading provides fast, lightweightconcurrency within a single process space. Threads are sometimesreferred to as lightweight processes or execution contexts.

Java™ thread support includes a sophisticated set of synchronizationprimitives based on the widely used monitor and condition variableparadigm introduced twenty years ago by C.A.R. Hoare and implemented ina production setting in Xerox PARC's Cedar/Mesa system. Java™ supportsmultithreading at the language (syntactic) level and via support fromits run-time system and thread objects. At the language level, Java™specifies that methods within a class that are declared “synchronized”do not run concurrently. Such methods run under control of monitors toensure that variables remain in a consistent state. Every class andinstantiated object has its own monitor that comes into play ifrequired. When a synchronized method is entered, it acquires a monitoron the current object. The monitor precludes any other synchronizedmethods in that object from running. When a synchronized method returnsby any means, its monitor is released. Other synchronized methods withinthe same object are then free to run.

While other systems have provided facilities for multithreading (usuallyvia “lightweight process” libraries), building multithreading supportinto the language as Java™ has done provides the programmer with a muchmore powerful tool for easily creating thread-safe multithreadedclasses. Other benefits of multithreading are better interactiveresponsiveness and real-time behavior.

Nonetheless, the built-in support for multithreading in the Java™Language has its drawbacks. For example, applications may contend forthe execution of a static synchronized method. A synchronized methodacquires a monitor lock before it executes, and a static method isinvoked without reference to a particular object. For a staticsynchronized method, the lock associated with the class object for themethod's class is used. One application may acquire a lock on a staticsynchronized method and refuse to release the lock, thereby preventingother applications from invoking the method.

Therefore, an improved system and method for efficiently isolatingapplications within a single virtual machine is desired.

SUMMARY OF THE INVENTION

The problems outlined above are in large part solved by variousembodiments of a system and method for isolating the execution of aplurality of applications by providing multiple monitors for asynchronized method. The applications may include applets, servlets,operating system services, components, JavaBeans™, or other suitableexecutable units or programs. “Application” and “program” are hereinused synonymously. In one embodiment, the applications are executable ina platform-independent programming environment such as the Java™environment. In one embodiment, the applications are executable on asingle instance of a virtual machine, such as a Java™ Virtual Machine,which is implemented in accordance with a platform-independent virtualmachine specification, such as the Java™ Virtual Machine Specification.

The general approach of the system and method includes providing aplurality of monitors for a plurality of applications to access asynchronized method. The applications are enabled or permitted to callthe synchronized method concurrently by accessing the synchronizedmethod through the plurality of monitors. A plurality of threads withinone of the applications are excluded or prevented from calling thesynchronized method concurrently. In one embodiment, the synchronizedmethod is a static synchronized method such as in the Java™ Language. Inone embodiment, each monitor corresponds to one of the plurality ofapplications which calls the synchronized method; in other words, thereis a one-to-one correspondence between applications and monitors. Invarious embodiments, the source code or bytecode for the synchronizedmethod may be transformed by removing a method-level monitor and addingthe plurality of monitors inside the method.

The plurality of applications may utilize one or more “original”classes. In other words, the original classes may be shared by aplurality of applications. Each of the one or more original classes mayinclude at least one static synchronized method. Each staticsynchronized method includes an executable block which comprises thebody of the method. In one embodiment, each static synchronized methodis replaced with a corresponding static non-synchronized method. Thecorresponding static non-synchronized method includes the executableblock from the corresponding static synchronized method, and theexecutable block in the static non-synchronized method may besynchronized on the corresponding instance of the static field class forthe utilizing application.

In one embodiment, zero or more static fields are extracted from one ormore original classes utilized by any of the plurality of applications,wherein each of the one or more original classes includes at least onestatic field. In one embodiment, a separate copy of the zero or morestatic fields is created for each of the plurality of applications,wherein each of the separate copies corresponds to one of the pluralityof applications. Creating the separate copy of the zero or more staticfields may include creating a static field class which includes instancefields corresponding to the zero or more static fields, wherein eachinstance of the static field class corresponds to one of the pluralityof applications. In one embodiment, access methods for the zero or morestatic fields may be created. The access methods are operable to accessthe corresponding separate copy of the zero or more static fields basedupon the identity of the utilizing or calling application. Creatingaccess methods for each of the zero or more static fields may includecreating a single access methods class for each original class whichincludes the access methods for accessing the extracted fields from theoriginal class.

In one embodiment, the method for isolating the execution of theapplications is transparent to the utilizing applications. In variousembodiments, the extraction of the static fields, creation of theseparate copies of the static fields, creation of the access methods,and replacing the static synchronized methods may be performed atrun-time or at compilation, and at the source level or the bytecodelevel. In a further embodiment, the method may be performed uponstructures rather than classes, such as in a programming environmentthat is not object-oriented.

BRIEF DESCRIPTION OF THE DRAWINGS

Other objects and advantages of the invention will become apparent uponreading the following detailed description and upon reference to theaccompanying drawings in which:

FIG. 1 is an illustration of a typical computer system architecturewhich is suitable for implementing various embodiments.

FIG. 2 is an illustration of a Java™ Platform architecture which issuitable for implementing various embodiments.

FIGS. 3 through 5 are illustrations of class sharing between twoapplications according to various embodiments.

FIG. 6 is an illustration of static field separation according to oneembodiment.

FIG. 7 is a flowchart of static field separation according to oneembodiment.

FIG. 8 illustrates an example of static field separation according toone embodiment.

FIG. 9 illustrates the contention of multiple applications for asynchronized static method in a multi-threaded, multi-applicationprocess space.

FIGS. 10 and 11 illustrate the system and method of isolating staticsynchronized methods in a multi-threaded, multi-application environmentaccording to one embodiment.

While the invention is susceptible to various modifications andalternative forms, specific embodiments thereof are shown by way ofexample in the drawings and will herein be described in detail. Itshould be understood, however, that the drawing and detailed descriptionthereto are not intended to limit the invention to the particular formdisclosed, but on the contrary, the intention is to cover allmodifications, equivalents and alternatives falling within the spiritand scope of the present invention as defined by the appended claims.

DETAILED DESCRIPTION OF SEVERAL EMBODIMENTS

FIG. 1: A Typical Computer System

Turning now to the drawings, FIG. 1 is an illustration of a typical,general-purpose computer system 100 which is suitable for implementingthe system and method for application isolation as disclosed herein. Asdiscussed with reference to FIGS. 10 and 11, the system and method forapplication isolation may include providing multiple monitors to permitmultiple applications to access a single static synchronized methodwhile minimizing inter-application interference.

The computer system 100 includes at least one central processing unit(CPU) or processor 102. The CPU 102 is coupled to a memory 104 and aread-only memory (ROM) 106. The memory 104 is representative of varioustypes of possible memory media: for example, hard disk storage, floppydisk storage, removable disk storage, or random access memory (RAM). Theterms “memory” and “memory medium” may include an installation medium,e.g., a CD-ROM or floppy disk, a computer system memory such as DRAM,SRAM, EDO RAM, Rambus RAM, etc., or a non-volatile memory such as amagnetic media, e.g., a hard drive, or optical storage. The memorymedium may include other types of memory as well, or combinationsthereof In addition, the memory medium may be located in a firstcomputer in which the programs are executed, or may be located in asecond different computer which connects to the first computer over anetwork. In the latter instance, the second computer provides theprogram instructions to the first computer for execution.

As shown in FIG. 1, typically the memory 104 permits two-way access: itis readable and writable. The ROM 106, on the other hand, is readablebut not writable. The memory 104 and/or ROM 106 may store instructionsand/or data which implement all or part of the system and methoddescribed in detail herein, and the memory 104 and/or ROM 106 may beutilized to install the instructions and/or data. In variousembodiments, the computer system 100 may take various forms, including apersonal computer system, desktop computer, laptop computer, palmtopcomputer, mainframe computer system, workstation, network appliance,network computer, Internet appliance, personal digital assistant (PDA),embedded device, smart phone, television system, or other suitabledevice. In general, the term “computer system” can be broadly defined toencompass any device having a processor which executes instructions froma memory medium.

The CPU 102 may be coupled to a network 108. The network 108 isrepresentative of various types of possible networks: for example, alocal area network (LAN), wide area network (WAN), or the Internet. Thesystem and method for application isolation in accordance as disclosedherein may therefore be implemented on a plurality of heterogeneous orhomogeneous networked computer systems 100 through one or more networks108. The CPU 102 may acquire instructions and/or data for implementingsystem and method for application isolation in accordance as disclosedherein over the network 108.

Through an input/output bus 110, the CPU 102 may also coupled to one ormore input/output devices that may include, but are not limited to,video monitors or other displays, track balls, mice, keyboards,microphones, touch-sensitive displays, magnetic or paper tape readers,tablets, styluses, voice recognizers, handwriting recognizers, printers,plotters, scanners, and any other devices for input and/or output. TheCPU 102 may acquire instructions and/or data for implementing the systemand method for application isolation as disclosed herein through theinput/output bus 110.

The computer system 100 is operable to execute one or more computerprograms. The computer programs may comprise operating system or othersystem software, application software, utility software, Java™ applets,and/or any other sequence of instructions. Typically, an operatingsystem performs basic tasks such as recognizing input from the keyboard,sending output to the display screen, keeping track of files anddirectories on the disk, and controlling peripheral devices such as diskdrives and printers. Application software runs on top of the operatingsystem and provides additional functionality. Because applications takeadvantage of services offered by operating systems, and becauseoperating systems differ in the services they offer and in the way theyoffer the services, an application must usually be designed to run on aparticular operating system. The computer programs are stored in amemory medium or storage medium such as the memory 104 and/or ROM 106,or they may be provided to the CPU 102 through the network 108 or I/Obus 110.

In one embodiment, the computer programs executable by the computersystem 100 may be implemented in the Java™ Language. The Java™ Languageis described in The Java Language Specification by Gosling, Joy, andSteele (Addison-Wesley, ISBN 0-201-63451-1), which is incorporatedherein by reference. A general discussion of the Java™ Language follows.The Java™ Language is an object-oriented programming language. In anobject-oriented programming language, data and related methods can begrouped together or encapsulated to form an entity known as an object.All objects in an object-oriented programming system belong to a class,which can be thought of as a category of like objects which describesthe characteristics of those objects. Each object is created as aninstance of the class by a program. The objects may therefore be said tohave been instantiated from the class. The class sets out variables andmethods for objects which belong to that class. The definition of theclass does not itself create any objects. The class may define initialvalues for its variables, and it normally defines the methods associatedwith the class (i.e., includes the program code which is executed when amethod is invoked.) The class may thereby provide all of the programcode which will be used by objects in the class, hence maximizing re-useof code which is shared by objects in the class.

FIG. 2: The Java™ Platform

The Java™ Platform which utilizes the object-oriented Java™ Language isa software platform for delivering and running the same applications ona plurality of different operating systems and hardware platforms. Aswill be described in further detail below, the Java™ Platform includessystem-dependent portions and system-independent portions, and thereforethe Java™ Platform may be thought of as having multiple embodiments. TheJava™ Platform sits on top of these other platforms, in a layer ofsoftware above the operating system and above the hardware. FIG. 2 is anillustration of the Java™ Platform and the relationships between theelements thereof in one embodiment. The Java™ Platform has two basicparts: the Java™ Virtual Machine 222, and the Java™ ApplicationProgramming Interface (Java™ API). The Java™ API may be thought of ascomprising multiple application programming interfaces (APIs). Whileeach underlying platform has its own implementation of the Java™ VirtualMachine 222, there is only one Virtual Machine specification. The Java™Virtual Machine specification is described in The Java Virtual MachineSpecification by Lindholm and Yellin (Addison-Wesley, ISBN0-201-63452-X), which is incorporated herein by reference. By allowingthe Java™ applications 236 to execute on the same Virtual Machine 222across many different underlying computing platforms, the Java™ Platformcan provide a standard, uniform programming interface which allows Java™applications 236 to run on any hardware on which the Java™ Platform hasbeen implemented. The Java™ Platform is therefore designed to provide a“rite once, run anywhere” capability.

Developers may use the Java™ Language and Java™ APIs to write sourcecode for Java™-powered applications 236. A developer compiles the sourcecode only once to the Java™ Platform, rather than to the machinelanguage of an underlying system. Java™ programs compile to bytecodeswhich are machine instructions for the Java™ Virtual Machine 222. Aprogram written in the Java™ Language compiles to a bytecode file whichcan run wherever the Java™ Platform is present, on any underlyingoperating system and on any hardware. In other words, the same Java™application can run on any computing platform that is running the Java™Platform. Essentially, therefore, Java™ applications 236 are expressedin one form of machine language and are translated by software in theJava™ Platform to another form of machine language which is executableon a particular underlying computer system.

The Java™ Virtual Machine 222 is implemented in accordance with aspecification for a “soft” computer which can be implemented in softwareor hardware. As used herein, a “virtual machine” is generally aself-contained operating environment that behaves as if it were aseparate computer. As shown in FIG. 2, in one embodiment, the Java™Virtual Machine 222 is implemented in a software layer. Variousimplementations of the Java™ Virtual Machine 222 can run on a variety ofdifferent computing platforms: for example, on a browser 214 sitting ontop of an operating system (OS) 212 a on top of hardware 210 a; on adesktop operating system 212 b on top of hardware 210 b; on a smalleroperating system 212 c on top of hardware 210 c; or on the JavaOSoperating system 218 on top of hardware 210 d. Computer hardware 210 a,210 b, 210 c, and 210 d may comprise different hardware platforms.JavaOS 218 is an operating system that is optimized to run on a varietyof computing and consumer platforms. The JavaOS 218 operatingenvironment provides a runtime specifically tuned to run applicationswritten in the Java™ Language directly on computer hardware withoutrequiring another operating system.

The Java™ API or APIs form a standard interface to Java™ applications236, regardless of the underlying operating system or hardware. TheJava™ API or APIs specify a set of programming interfaces between Java™applications 236 and the Java™ Virtual Machine 222. The Java™ Base API226 provides the basic language, utility, I/O, network, GUI, and appletservices. The Java™ Base API 226 is typically present anywhere the Java™Platform is present. The Java™ Base Classes 224 are the implementationof the Java™ Base API 226. The Java™ Standard Extension API 230 providesadditional capabilities beyond the Java™ Base API 226. The Java™Standard Extension Classes 228 are the implementation of the Java™Standard Extension API 230. Other APIs in addition to the Java™ Base API226 and Java™ Standard Extension API 230 can be provided by theapplication or underlying operating system. A particular Java™environment may include additional APIs 234 and the classes 232 whichimplement them. Each API is organized by groups or sets. Each of the APIsets can be implemented as one or more packages or namespaces. Eachpackage groups together a set of classes and interfaces that define aset of related data, constructors, and methods, as is well known in theart of object-oriented programming.

The porting interface 220 lies below the Java™ Virtual Machine 222 andon top of the different operating systems 212 b, 212 c, and 218 andbrowser 214. The porting interface 220 is platform-independent. However,the associated adapters 216 a, 216 b, and 216 c are platform-dependent.The porting interface 220 and adapters 216 a, 216 b, and 216 c enablethe Java™ Virtual Machine 222 to be easily ported to new computingplatforms without being completely rewritten. The Java™ Virtual Machine222, the porting interface 220, the adapters 216 a, 216 b, and 216 c,the JavaOS 218, and other similar pieces of software on top of theoperating systems 212 a, 212 b, and 212 c may, individually or incombination, act as means for translating the machine language of Java™applications 236, APIs 226 and 230, and Classes 224 and 228 into adifferent machine language which is directly executable on theunderlying hardware.

FIGS. 3, 4, and 5: Class Sharing Among Applications

FIGS. 3, 4, and 5 illustrate several approaches to class sharing amongconcurrently executing applications. In one embodiment, severalrecommendations and/or assumptions may be made about the class of theenvironments targeted with these approaches. First, each application isassumed to have an identifier which can be obtained from the currentthread. In general, it is not important whether this identifier is anobject or an integer. It is also recommended that the onlyinter-application communication mechanisms are via mechanisms which copydata. In other words, it is recommended that there is no mechanism forpassing an object reference from one application to another. Third, theenvironments of interest should have a way to launch multipleapplications. In an embodiment in which the applications are implementedin Java™, another recommendation may be made concerning the native code.In this embodiment, it is recommended that the only native methodspresent are the ones defined in core Java™ classes bundled with the JVM.Following this recommendation will tend to ensure that applications areisolated from interference at the native code level.

It is further recommended that thread termination and suspensionrequests are deferred whenever the thread executes non-reentrant nativecode and are effective immediately upon return. It is recommended thatno part of native code should both be non-reentrant and blocking. Usingmonitors may enables such structuring of the native code. Withoutmeeting this recommendation, the system and method for applicationisolation as described herein may still be used to isolate applications,but their clean termination may be difficult.

FIG. 3 illustrates class sharing in a typical Java™ multiprocessingenvironment in which all applications share all classes. A firstapplication 310 and a second application 320 are shown for purposes ofillustration. Both applications 310 and 320 utilize application class304 and system class 308. This approach relies on the fact that Java™ isa safe language and already includes some limited built-in support forisolating applications from one another. For example, data referencescannot be forged. Consequently, the only data exchange mechanism,barring explicit Inter-Process Communications, is through static fieldssuch as static fields 302 (associated with application class 304) and306 (associated with system class 308). As used herein, a “static field”generally includes any data field or storage location which is shared bymore than one application, process, thread, class, instance, structure,or other suitable domain. In the Java™ Language, for example, a classstatic field is a field which exists only once per class.

In the absence of application-defined native code (as recommendedabove), inter-application communication through static fields can beperformed by explicit manipulation of static fields 302 and 306 or byinvoking methods which access these fields. This use of static fields302 and 306 can lead to unexpected and incorrect behavior depending onhow many applications use the same class with static fields.

FIG. 4 illustrates a class sharing approach dependent on class-loaderbased protection. Each application 310 and 320 has a separate copy 304 aand 304 b of the application class (with respective static fields 302 aand 302 b), but all system classes such as system class 308 (with staticfields 306) are shared. Two observations are important in this case.First, typically class loaders do not share enough: namely, there is noneed to replicate the code of application classes 304 a and 304 b.Second, class loaders share too much: namely, they share static fields306 of system classes 308. As above, the sharing of static fields 306across applications may lead to unexpected behavior depending on how thesharing applications use the shared fields.

FIG. 5 illustrates an approach that addresses the shortcomings of thetwo methods described above with reference to FIGS. 3 and 4. As FIG. 5shows, separation between applications 310 and 320 may be achieved bymaintaining a separate copy of static fields for each class, with onesuch copy per application that uses a given class. For example, thefirst application 310 may have access to static instance fields 502 a ofan application class 504 and static instance fields 506 a of a systemclass 508, and the second application 320 may have access to staticinstance fields 502 b of the application class 504 and static instancefields 506 b of the system class 508. However, only one copy of anyclass exists in the system, regardless of how many applications utilizeit, since methods cannot transfer data from one application to anotherafter the communication channel provided by the static fields isremoved. Therefore, the system and method for application isolation asdescribed herein effectively gives each application 310 and 320 anillusion that it has exclusive access to static fields, while inreality, each application 310 and 320 has a separate copy of thesefields.

The approach shown in FIG. 5 combines the best features of the OS-basedapproach and the class-loader based approach. First, it permits aplurality of applications to execute in a single virtual machine. Thiscapability has all the advantages of class loaders over processes inthat switching from one application to another does not require a costlyprocess context switch, startup time is faster, and fewer resources perapplication are necessary, which improves the overall systemscalability. Second, only one copy of a class is loaded into the system,regardless of how many applications use it. This improves over bothexisting approaches (as discussed with reference to FIGS. 3 and 4) interms of both saved code space and saved repeated compilation time.Third, applications are isolated from one another, i.e., they cannotexchange data through shared variables of any class, be it anapplication class or a system class, and they cannot block one anotherfrom calling synchronized methods. This is a separation level expectedfrom an operating system approach and an improvement over what classloaders can offer. Finally, no new application-programming interface isintroduced. In particular, existing applications' bytecode does not haveto be modified in order to execute under the proposed isolation model.

FIGS. 6, 7, and 8: Separating the Static Fields Component of a Class

FIGS. 6, 7, and 8 illustrate embodiments of the system and method forisolating the execution of applications by separating out the staticfields component of a class as discussed with reference to FIG. 5. Forpurposes of illustration, the process of separating out the staticfields component of a class is described as follows in the context of ahypothetical source-to-source transformation implementation. In anotherembodiment of the invention, the separation process may be performed bythe same transformations but at the bytecode level. Bytecode-to-bytecodetransformation is typically preferable over Java-to-Java sourcetransformation since often the source is not available. However, theJava-to-Java source transformation is more appropriate for bothexplaining the process and exposing technical details and implementationissues. In various embodiments, the transformation may be performed atrun-time or at compilation.

The applications may include applets, servlets, operating systemservices, components, JavaBeans™, or other suitable executable units orprograms. “Application” and “program” are herein used synonymously. Inone embodiment, the applications are executable in aplatform-independent programming environment such as the Java™environment as discussed with reference to FIG. 2. In one embodiment,the applications are executable on a single instance of a virtualmachine, such as a Java™ Virtual Machine, which is implemented inaccordance with a platform-independent virtual machine specification,such as the Java™ Virtual Machine Specification.

FIG. 6 illustrates the process of separating out the static fieldscomponent of a class according to one embodiment. In variousembodiments, the steps shown in FIG. 6 may be performed in a differentorder than the order shown. The plurality of applications may utilizeone or more “original” classes. In other words, the original classes maybe shared by a plurality of applications. In one embodiment of thesystem and method for isolating applications, only one copy of eachoriginal class is maintained, regardless of how many applicationsutilize it. Classes may be transparently and automatically modified asshown in steps 602 through 606. In step 602, one or more static fieldsare extracted from one or more original classes utilized by any of theplurality of applications, wherein each of the one or more originalclasses includes at least one static field.

In step 604, a separate copy of the one or more static fields is createdfor each of the plurality of applications, wherein each of the separatecopies corresponds to one of the plurality of applications. Creating theseparate copy of the one or more static fields may include creating astatic field class which includes instance fields corresponding to theone or more static fields, wherein each instance of the static fieldclass corresponds to one of the plurality of applications. In these newclasses, the type modifier of the fields is converted from static tosimple instance fields. These fields may henceforth be referred to asstatic instance fields.

In step 606, one or more access methods for the static fields may becreated. As used herein, an “access method” is a method that providesaccess to storage locations such as static fields. The access methodsare operable to access the corresponding separate copy of the one ormore static fields based upon the identity of the utilizing or callingapplication. Creating access methods for each of the one or more staticfields may include creating a single access methods class for eachoriginal class which includes the access methods for accessing theextracted fields from the original class. The new class which containsthe access methods for the new static instance fields may hereinafter bereferred to as the static instance field access class or access methodsclass.

In one embodiment, as described above and illustrated by FIG. 7, anyoriginal class 702 containing static fields 704 is transparently andautomatically split into three classes: the original class includinginstance fields 706 and methods 708 but without the static fields 704,referred to as the modified original class 702 a; a new class containingall the static fields which are now instance fields 714, referred to asthe static instance field class or static field class 712; and a newclass containing methods 718 to access these fields, the static instancefield access class or access methods class 716. The access methods class716 maintains a copy (i.e., instance) of each static field class 712 perapplication domain and is operable to access the proper copy (i.e.,instance) of this class based on the application identity extracted fromthe current thread. In one embodiment, only one copy of the modifiedoriginal class 702 a and access methods class 716 is present in thevirtual machine regardless of the number of applications using theoriginal class. In this manner, the amount of class replication isminimized, and the overall memory footprint is minimized as a result.Also, any fields prone to inter-application interference are replicatedand isolated to assure a secure processing environment for eachapplication. The system and method shown in FIGS. 6 and 7 may also allowclass loaders to be removed from the type system.

In another embodiment, the method for separating static fields fromoriginal classes may be performed upon structures rather than classes,such as in a programming environment that is not object-oriented.

FIG. 8 illustrates an example of source code of a class 802 with astatic field before the separation transformations, and the threeresulting classes 804 after the transformation, according to oneembodiment of the system and method. In this example, the original class802 is a simple counter class. It includes a single static membervariable, called counter; a static initializer; and a static method,add, which is used to modify the value of counter.

In one embodiment, the transformations affect only static fields and theway they are accessed. The original class, Counter, undergoes thefollowing modifications. In one embodiment, all static fields areremoved from Counter. A new method, hidden$initializer( ), is added. Itcontains a modified version of the code of the static initializer ofCounter. It is invoked whenever a new domain uses the static fields ofCounter for the first time. The code for hidden$initializer( ) ispresented in resulting classes 804.

The second new class, Counter$sFields, contains all the static fields ofCounter. In one embodiment, all modifiers (static, final, private, etc)are removed from the fields so that they have package access. Thus, allstatic fields of Counter become instance, non-final, package-accessfields of the new class Counter$sFields, as shown in resulting classes804.

The third and final generated class is Counter$aMethods. It contains atable mapping domain identifiers onto per-domain copies ofCounter$sFields. For each field from Counter$sFields there is a pair ofget$( ) and put$( ) methods in Counter$aMethods. In this example, thereis only one static field, and thus Counter$aMethods has only two suchaccess methods: put$cnt( ) and get$cnt( ). Each of them looks up thecopy of Counter$sFields corresponding to the current domain and thenaccesses the named field. If the lookup does not succeed, it means thatthis domain's copy of Counter$sFields has not been generated yet andthat the appropriate initialization must be made. In an alternateembodiment, the field(s) in Counter$sFields and the methods ofCounter$aMethods could be stored in the original class file of Counter.In embodiments using the Java™ Language, it should be noted that this ispossible for proper classes only; interfaces typically cannot havenon-abstract methods.

Once these modifications are performed, the code of each method isinspected as follows. In one embodiment, each access to a static fieldis automatically replaced with the appropriate get$( ) or put$( )method. At the bytecode-to-bytecode transformation level, this becomes areplacement of each getstatic or putstatic instruction with get$( ) orput$( ), respectively.

In one embodiment, the automatic transformations described above may beaugmented with manual re-coding of several atypical classes. Forexample, in some implementations of the JVM, the System.out field isinitialized by the runtime. It is important to ensure that eachapplication has an access to System.out (if a security policy of a givenenvironment allows this) and, at the same time, that this static fieldis not directly shared by the applications. System properties areanother example. Policy decisions may be made concerning whetherapplications can write to a shared copy of system properties, or whethereach application should see a separate, read-only copy, or whether someother solution is appropriate. In general, resources that are shared byall classes should be identified for each particular JVM. However, suchmanifestations of a single-processing original nature of Java™ are veryrare. Therefore, manually dealing with these manifestations may beappropriate for only a handful of system classes. Simply wrappingobjects and marking the wrapped classes as non-transformable may be themost effective solution.

According to the system and method discussed with reference to FIGS. 6through 8, classes can be modified one-by-one. In other words, theregenerally is no need to analyze another class before ending themodifications to the current class (“peephole code modification”).Another desirable property of the system and method is that the changesmay involve source-to-source post-compilation transformation and as suchare portable.

Optimizations

In various embodiments, there are a number of optimizations for thesystem and method which may be performed as source-to-sourcetransformations. As such, they do not break portability, but some mayrequire analyzing more than one class before optimized modifications toa particular class can be completed.

One category of optimizations is preserving selected final static fieldsin their original classes. In such cases, original getstatic (and, ininitialization code, putstatic) instructions are left unmodifiedwhenever accessing such preserved fields. This avoids the need to lookup the current application identifier and then to find the corresponding$sFields object.

The most straightforward optimization is to preserve final static fieldsof primitive types in their original classes since this does not lead toany inter-application interference. When applying this optimization, itmay be appropriate to scan the bytecode of referenced classes in orderto determine whether or not a field named in get static or putstatic isfinal.

Another optimization may be to preserve static final strings in theiroriginal classes. Strings are immutable, so their fields or methodscannot act as a data communication channel between applications.However, if an application uses a static final string as a monitorobject for a synchronized statement, another instance of thisapplication may compete for the same lock. Thus, preserving static finalstrings may sometimes lead to unwanted interference at the level ofaccessing mutual exclusion code.

In general, it is recommended that objects be preserved in theiroriginal classes only if they are not used as synchronization objectsand if they are immutable. A special category of such objects is arraysof primitive types. A simple, conservative analysis often suffices todetermine that a given static final array is in fact immutable.Preserving such immutable arrays in their original classes may lead tosignificant performance gains in some special cases.

In one embodiment, therefore, a set of static fields may be classifiedas secure for utilization by the plurality of applications withoutinter-application interference. The secure set of static fields mayinclude final static fields of primitive types, final static strings,immutable arrays of primitive types, and/or other appropriate fields.The secure set of static fields may then be preserved within the one ormore classes. In other words, the set of static fields may be exemptedfrom the one or more static fields which are extracted from the one ormore classes.

Some further optimizations may also be performed. For example, foractual classes (i.e., not interfaces), all the new qet$( ) and put$( )methods may actually be added to the class itself. This techniqueeffectively merges the $aMethods classes into their original classes,although the performance gains from this method are uncertain.

The approach described above minimizes the amount of resources neededfor running multiple applications in the same copy of a virtual machinesuch as the JVM. Only one copy of each class exists in the system. Thisleads to fast startup of applications whose instances are alreadyrunning and minimizes the space needed for code, especially for theJITed code. As has been discussed above, applications can be protectedfrom one another both at the level of data access and at the level ofaccess to static synchronized methods.

In one embodiment of the invention using a Java™ Virtual Machine, theisolation system and method described above may be added to the JVMruntime. The rationale behind implementing them in a custom runtime is(1) to minimize the overheads, (2) to simplify the implementation, and(3) to remove bytecode editing from the critical “fetch classfile-load-execute” path when bytecode editing cannot be done off-line.In one embodiment, an efficient way to modify the runtime may be toprovide the per-application copies of static fields along with theloaded class image. This tends to ensure that no bytecode has to bemodified. In particular, no new classes are generated and no fieldaccess modifiers are changed, which addresses security concerns. Pastexperience with moving from a bytecode-editing prototype to a customruntime (in order to account for computational resources) indicates thatin the case of application isolation, the overheads can be reduced by anorder of magnitude. See Czajkowski, G., and von Eicken, T., JRes: AResource Control Interface for Java, In Proceedings of ACM OOPSLA'98,Vancouver, BC, Canada, October 1998. The price is the loss ofportability of the multiprocessing layer, inherent in customizing theruntime.

FIG. 9: Threads And Static Synchronized Methods

FIG. 9 illustrates the contention of multiple applications for asynchronized static method in a multi-threaded, multi-applicationprocess space. Application 902 a with execution threads 904 a relies onmonitor 910 for access to the static synchronized method 908. Similarly,application 902 b executing threads 904 b accesses the synchronizedstatic method 908 via the monitor 910. As used herein, the terms “lock”and “monitor” are used interchangeably. Because the method 908 isstatic, it is shared between the two applications 902; and because it isdeclared synchronized, only one application may access it at a giventime. Assuming, for example, that application 902 a has received thelock 910 on the method 908, the other application 902 b must wait untilthe first application 902 a has released the lock 910 to gain access. Iffor some reason, application 902 a suspends the controlling thread, suchthat the lock 910 is not released, then application 902 b will be deniedaccess to the method 908.

FIGS. 10 and 11: Isolation of Static Synchronized Methods

FIGS. 10 and 11 illustrate the system and method of isolating staticsynchronized methods in a multi-threaded, multi-application environment.The problems of inter-application interference due to contention for astatic synchronized method may in large part be addressed by isolatingthe execution of a plurality of applications by providing multiplemonitors for the static synchronized method. As noted above, theapplications may include applets, servlets, operating system services,components, JavaBeans™, or other suitable executable units or programs.

FIG. 10 illustrates the general approach of providing a plurality ofmonitors for a plurality of applications to access a synchronized methodaccording to one embodiment. The applications 902 a and 902 b areenabled or permitted to call the synchronized method 1008 concurrentlyby accessing the synchronized method 1008 through the plurality ofmonitors 910 a and 910 b, respectively. In one embodiment, therefore,one application cannot typically prevent another application from usinga given synchronized method. A plurality of threads 904 within one ofthe applications are excluded or prevented from calling the synchronizedmethod concurrently.

In one embodiment, the synchronized method 1008 is a static synchronizedmethod such as in the Java™ Language. In one embodiment, each monitor910 corresponds to one of the plurality of applications 902 which callsthe synchronized method 1008; i.e., there is a one-to-one correspondencebetween applications 902 and monitors 910. In various embodiments, thesource code or the bytecode for the synchronized method 1008 may betransformed by removing a method-level monitor, which would be sharedamong applications, and adding the plurality of monitors inside themethod by using a monitor for each instance of the static field class,which would be specific to each application.

In one embodiment, the method for isolating the execution of theapplications may be transparent to the utilizing applications. It shouldalso be noted that in various embodiments, the extraction of the staticfields, creation of the separate copies of the static fields, creationof the access methods, and replacement the static synchronized methodsmay be performed at run-time or at compilation, and at the source levelor the bytecode level. Also, it should be noted that in a furtherembodiment, the method may not be limited to formal classes, but mayalso be applied to structures, such as in a programming environment thatis not object-oriented.

Referring back to FIG. 8 above, suppose that the add( ) function ofCounter is a synchronized method. This may lead to the following problemin the transformed code: one application calls add( ) and while thecalling thread executes the body of the method, it is suspended byanother thread from the same application. This may result in a seriousdenial-of-service problem since the suspended thread still holds a lockand no other application is able to execute Counter.add( ). This problemdoes not exist if multiple applications using the class Counter areloaded by separate class loaders. However, if class loaders areeliminated through the application of the system and method forapplication isolation shown in FIGS. 6 through 8, the problem remains.

As shown in the example of FIG. 11, a relatively simple transformationto the method code may address these problems. This transformation maybe performed in conjunction with the transformation described above withreference to FIGS. 6 through 8. As described above, the original classmay be shared by a plurality of applications, and include at least onestatic synchronized method. Typically, each static synchronized methodincludes an executable block of code which comprises the body of themethod.

As shown in FIG. 11, the original static synchronized method 1102modifies the static class variable counter. In the transformation of thestatic method (and optionally the static field separation described withreference to FIGS. 6 through 8), the synchronization for static methodsis replaced by synchronization on the $sFields object owned by thecurrent (i.e., utilizing or invoking) application. Specifically, in theexample code of the transformed method 1104, it may be seen that themethod itself is no longer synchronized. Instead, the instance of thestatic field class corresponding to the calling application is retrievedand synchronized over the scope of the method body. Hence, the “static”instance variables of the class (which are accessible only by thecurrent application) are modified in a way that restricts lockcontention to concurrently executing threads in the current application.In order to permit the generic solution as shown in FIGS. 10 and 11, itis recommended that $sFields objects be generated even for originalclasses which lack static fields.

Various embodiments may further include receiving or storinginstructions and/or data implemented in accordance with the foregoingdescription upon a carrier medium. Suitable carrier media may includestorage media or memory media such as magnetic or optical media, e.g.,disk or CD-ROM, as well as transmission media or signals such aselectrical, electromagnetic, or digital signals, conveyed via acommunication medium such as network 108 and/or a wireless link.

While the present invention has been described with reference toparticular embodiments, it will be understood that the embodiments areillustrated and that the invention scope is not so limited. Anyvariations, modifications, additions and improvements to the embodimentsdescribed are possible. These variations, modifications, additions andimprovements may fall within the scope of the invention as detailedwithin the following claims.

What is claimed is:
 1. A method for isolating the execution of aplurality of applications, the method comprising: providing a pluralityof monitors to access a synchronized method; enabling two or more of aplurality of applications to call the synchronized method concurrentlyby accessing the synchronized method through the plurality of monitors;and excluding a plurality of threads within one of the applications fromcalling the synchronized method concurrently.
 2. The method of claim 1,wherein each monitor corresponds to one of the plurality of applicationswhich calls the synchronized method.
 3. The method of claim 1, furthercomprising: transforming source code for the synchronized method byremoving a method-level monitor and adding the plurality of monitorsinside the method.
 4. The method of claim 1, further comprising:transforming bytecode for the synchronized method by removing amethod-level monitor and adding the plurality of monitors inside themethod.
 5. The method of claim 1, wherein the synchronized method is astatic synchronized method.
 6. A method for isolating the execution of aplurality of applications, the method comprising: extracting zero ormore static fields from an original class utilized by any of theplurality of applications, wherein the original class comprises at leastone static synchronized method, and wherein each static synchronizedmethod comprises an executable block; creating a static field class,wherein the static field class comprises zero or more instance fieldscorresponding to the zero or more static fields, and wherein eachinstance of the static field class corresponds to one of the pluralityof applications; and replacing each static synchronized method with acorresponding static non-synchronized method, wherein the correspondingstatic non-synchronized method comprises the executable block from thecorresponding static synchronized method which is synchronized on thecorresponding instance of the static field class for the utilizingapplication.
 7. The method of claim 6, wherein replacing each staticsynchronized method with the corresponding static non-synchronizedmethod further comprises providing a plurality of monitors to access thestatic non-synchronized method.
 8. The method of claim 6, whereinreplacing each static synchronized method with the corresponding staticnon-synchronized method further comprises enabling two or more of theapplications to call the static non-synchronized method concurrently byaccessing the synchronized method through a plurality of monitors. 9.The method of claim 6, wherein replacing each static synchronized methodwith the corresponding static non-synchronized method further comprisesexcluding a plurality of threads within one of the applications fromcalling the static non-synchronized method concurrently.
 10. The methodof claim 6, further comprising: creating on e or more access methods forthe static fields, wherein the access methods are operable to access thecorresponding instance of the static field class based upon the identityof the utilizing application.
 11. The method of claim 6, whereinextracting the static fields, creating the static field class, andreplacing each static synchronized method are performed within a virtualmachine.
 12. The method of claim 11, wherein the virtual machine isimplemented in accordance with a platform-independent virtual machinespecification.
 13. The method of claim 6, wherein the plurality ofapplications are executable in a platform-independent programmingenvironment.
 14. The method of claim 6, wherein extracting the staticfields, creating the static field class, and replacing each staticsynchronized method is transparent to the utilizing applications. 15.The method of claim 6, wherein extracting the static fields, creatingthe static field class, and replacing each static synchronized methodare performed at run-time.
 16. The method of claim 6, wherein extractingthe static fields, creating the static field class, and replacing eachstatic synchronized method are performed at compilation.
 17. The methodof claim 6, wherein extracting the static fields, creating the staticfield class, and replacing each static synchronized method furthercomprise transforming the bytecode of the one or more applications. 18.The method of claim 6, wherein extracting the static fields, creatingthe static field class, and replacing each static synchronized methodfurther comprise transforming the source code of the one or moreapplications.
 19. A system for isolating the execution of a plurality ofapplications, the system comprising: an original class utilized by theplurality of applications, wherein the original class comprises zero ormore static fields and one or more static synchronized methods, andwherein each of the static synchronized methods comprises an executableblock; a modified original class generated from the original class,wherein the modified class comprises the original class without thestatic fields; a static field class generated from the original class,wherein each instance of the static field class corresponds to one ofthe plurality of applications, and wherein the static field classcomprises zero or more instance fields corresponding to the zero or morestatic fields of the original class; and one or more staticnon-synchronized methods, wherein each static non-synchronized method isgenerated from a corresponding one of the static synchronized methods,and wherein each static non-synchronized method comprises the executableblock from the corresponding static synchronized method which issynchronized on the corresponding instance of the static field class forthe utilizing application.
 20. The system of claim 19, furthercomprising: a virtual machine which is operable to execute the pluralityof applications.
 21. The system of claim 19, wherein the plurality ofapplications are executable in a platform-independent programmingenvironment.
 22. The system of claim 19, further comprising: an accessmethods class generated from the original class, wherein the accessmethods class comprises one or more access methods for accessing theinstance fields of the static field class.
 23. A carrier mediumcomprising program instructions which are computer-executable toimplement: extracting zero or more static fields from an original classutilized by any of a plurality of applications, wherein the originalclass comprises at least one static synchronized method, and whereineach static synchronized method comprises an executable block; creatinga static field class, wherein the static field class comprises zero ormore instance fields corresponding to the zero or more static fields,and wherein each instance of the static field class corresponds to oneof the plurality of applications; and replacing each static synchronizedmethod with a corresponding static non-synchronized method, wherein thecorresponding static non-synchronized method comprises the executableblock from the corresponding static synchronized method which issynchronized on the corresponding instance of the static field class forthe utilizing application.
 24. The carrier medium of claim 23, whereinin replacing each static synchronized method with the correspondingstatic non-synchronized method, the program instructions are furthercomputer-executable to implement providing a plurality of monitors toaccess the static non-synchronized method.
 25. The carrier medium ofclaim 23, wherein in replacing each static synchronized method with thecorresponding static non-synchronized method, the program instructionsare further computer-executable to implement enabling two or more of theapplications to call the static non-synchronized method concurrently byaccessing the synchronized method through a plurality of monitors. 26.The carrier medium of claim 23, wherein in replacing each staticsynchronized method with the corresponding static non-synchronizedmethod, the program instructions are further computer-executable toimplement excluding a plurality of threads within one of theapplications from calling the static non-synchronized methodconcurrently.
 27. The carrier medium of claim 23, wherein the programinstructions are further computer-executable to implement: creating oneor more access methods for the static fields, wherein the access methodsare operable to access the corresponding instance of the static fieldclass based upon the identity of the utilizing application.
 28. Thecarrier medium of claim 23, wherein extracting the static fields,creating the static field class, and replacing each static synchronizedmethod are performed within a virtual machine which is implemented inaccordance with a platform-independent virtual machine specification.29. The carrier medium of claim 23, wherein the carrier medium is amemory medium.
 30. The carrier medium of claim 23, wherein the carriermedium is a transmission medium.